|
Most Web servers and browsers have the ability to process requests in a variety of different formats, and the goal of encoded syntax attacks is to bypass detection. For example, a simple cross-site scripting (XSS) attack can be fixed with a variety of different character-encoding sets, including Unicode, UTF-8 and Hex. The problem is that many IDS/IPS products are signature-based and look for a specific attack string. Therefore, intrusion detection and prevention tools may not be able to catch an attacker that encodes a malicious request.
Organizations should test their Web servers to ensure that they are not vulnerable to encoded syntax attacks. To do so, I recommend tools like Nikto. The server-assessment tool utilizes a variety of different encoding techniques, and can even use multiple types of evasion tactics together. Nikto will request pages in a various ways that your server will understand but may be difficult for us to read. Many servers, for example, can process requests in Unicode and Base64, which are languages not easily deciphered by many people.
Also, look at ModSecurity, an open source Web application firewall and UrlScan, a security tool that restricts the types of HTTP requests that Internet Information Services (IIS) will process. These tools have the ability to detect and/or stop some of the most common encoded attacks like SQL injection, cross-site scripting and requests for pages on your site that may have vulnerabilities like buffer overflows. There are also a number of commercial products that can help defend against encoded syntax attacks, including those from F5 Networks Inc., Breach Security Inc., and Barracuda Networks Inc.
For more information:
Learn how to protect and harden a database server.
See how ModSecurity is getting an 'attitude adjustment.'
|
